CVE-2026-53550

Description

js-yaml is a JavaScript YAML parser and dumper. Prior to 4.2.0 and 3.15.0, a crafted YAML document can trigger algorithmic CPU exhaustion in js-yaml merge-key processing (<<) by repeating the same alias many times in a merge sequence. This causes quadratic parse-time behavior relative to input size and can block a Node.js worker/event loop for seconds with a relatively small payload (tens of KB), resulting in denial of service. The issue is in merge handling inside lib/loader.js. This vulnerability is fixed in 4.2.0 and 3.15.0.

Traduire en français

Produits concernés

• nodeca js-yaml

Scores CVSS

Faiblesses (CWE)

• CWE-407

Références

• https://github.com/nodeca/js-yaml/security/advisories/GHSA-h67p-54hq-rp68 ExploitMitigationVendor Advisory

Ailleurs

• NVD
• CVE.org
• CIRCL Vulnerability-Lookup
• CERT-FR
• GitHub Advisories